Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. Join them; it only takes a minute:

i am trying to use gdb to analyse a c program but i am a little confused.
in the above picture you can see i am trying to analyse the stack . On the left we have memory addresses.Since i am using a 64 bit machine ,shouldn't ever memory address have 64 bits?but in the picture every memory location has 32 bits . Also the stack starts at 0x28fed0 and the second address is 0x28fee0 ,where are the address between these.I mean where is 0x28fed1?
I studied architecture many years ago and i seem to be missing something basic.
Can any one help me out?

1 Answer
1

The stack is not intrinsically 64-bit, it's just a memory area which can contains anything.

You specifically asked gdb to dump the memory in 32-bit quantities:

x/32xw

32 is the count (you can see that you've got 8 lines of 4 columns), x is output format (hexadecimal), and w is the item size ("word" - a 32-bit integer).

If you want to view memory as an array of 64-bit items, replace w by g ("giant word" or a 64-bit integer). To see individual bytes, use b.

As for addressing, each 32-bit item occupies four 8-bit bytes, so a row of four of them adds up to 4*4=16, or 0x10 bytes, that's why the next line starts at 0x28fee0. The byte at address 0x28fed1 is present inside the 32-bit word at 0x28fed0. Try dumping memory in different formats to get the feel for the data layout. Read up on little endian.

Amazing answer ,i know about Endianness but got a little confused.just one more thing you said "The stack is not intrinsically 64-bit, it's just a memory area which can contains anything."so how much bits or bytes can be stored on a single memory location i.e single memory address
– shujaatMay 10 '18 at 5:44